Would special punctuation cause a problem? -G ------------------------------ Geoff Galitz http://www.galitz.org From csullo at gmail.com Mon Nov 19 11:22:17 2012 From: csullo at gmail.com (Sullo) Date: Mon, 19 Nov 2012 12:22:17 -0500 Subject: [Nikto-discuss] db_404_strings processing In-Reply-To: <8976dd6205eb1dccc8e7eff42150eb27.squirrel@webmail.sonic.net> References: <8976dd6205eb1dccc8e7eff42150eb27.squirrel@webmail.sonic.net> Message-ID: That should work. what is the response code you're sending for 404s, is it 200 or something else? Also, you can put them in udb_404_strings so an update won't step on your own changes. -Sullo On Mon, Nov 19, 2012 at 12:06 PM, Geoff Galitz wrote: > > > Hi all. > > I am getting what seem to be false positives. I suspect nikto is not > recognizing the custom 404s we send out. I've added some of the text and > some of the unique code of our 404 to db_404_strings but it does not seem > to help. > > I am wondering if I need to do anything special after simply adding some > text to that file? Currently I have this:

style="bottom: 98px;"> > > Would special punctuation cause a problem? > > -G > > > > ------------------------------ > Geoff Galitz > http://www.galitz.org > > _______________________________________________ > Nikto-discuss mailing list > Nikto-discuss at attrition.org > https://attrition.org/mailman/listinfo/nikto-discuss > -- http://www.cirt.net | http://richsec.com/ -------------- next part -------------- An HTML attachment was scrubbed... URL: From geoff at galitz.org Mon Nov 19 11:51:44 2012 From: geoff at galitz.org (Geoff Galitz) Date: Mon, 19 Nov 2012 09:51:44 -0800 Subject: [Nikto-discuss] db_404_strings processing In-Reply-To: References: <8976dd6205eb1dccc8e7eff42150eb27.squirrel@webmail.sonic.net> Message-ID: If I use curl -v to inspect it, it shows as a 404, though we return a pretty big page with that. It seems like all of these false positives are XSS related. When I issue that URL manually (in a web browser or via curl) I get the expected custom 404 page. Among the vast volume of output from nikto are lines like this: + OSVDB-651: /cgi-local/cgiemail-1.6/cgicso?query=: This CGI is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html. + OSVDB-651: /cgi-local/cgiemail-1.4/cgicso?query=: This CGI is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html. + OSVDB-7022: /calendar.php?year=&month=03&day=05: DCP-Portal v5.3.1 is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html. It could be that my theory on why this is happening is just plain wrong. -G > That should work. what is the response code you're sending for 404s, is it > 200 or something else? > > Also, you can put them in udb_404_strings so an update won't step on your > own changes. > > -Sullo > > On Mon, Nov 19, 2012 at 12:06 PM, Geoff Galitz wrote: > >> >> >> Hi all. >> >> I am getting what seem to be false positives. I suspect nikto is not >> recognizing the custom 404s we send out. I've added some of the text >> and >> some of the unique code of our 404 to db_404_strings but it does not >> seem >> to help. >> >> I am wondering if I need to do anything special after simply adding some >> text to that file? Currently I have this:

> style="bottom: 98px;"> >> >> Would special punctuation cause a problem? >> >> -G >> >> >> >> ------------------------------ >> Geoff Galitz >> http://www.galitz.org >> >> _______________________________________________ >> Nikto-discuss mailing list >> Nikto-discuss at attrition.org >> https://attrition.org/mailman/listinfo/nikto-discuss >> > > > > -- > > http://www.cirt.net | http://richsec.com/ > ------------------------------ Geoff Galitz http://www.galitz.org From csullo at gmail.com Mon Nov 19 11:54:49 2012 From: csullo at gmail.com (Sullo) Date: Mon, 19 Nov 2012 12:54:49 -0500 Subject: [Nikto-discuss] db_404_strings processing In-Reply-To: References: <8976dd6205eb1dccc8e7eff42150eb27.squirrel@webmail.sonic.net> Message-ID: is the attack string echoed in the 404 page anywhere? those should match on the content with a regex, and only trigger if that raw string is found. On Mon, Nov 19, 2012 at 12:51 PM, Geoff Galitz wrote: > > If I use curl -v to inspect it, it shows as a 404, though we return a > pretty big page with that. > > It seems like all of these false positives are XSS related. When I issue > that URL manually (in a web browser or via curl) I get the expected custom > 404 page. > > Among the vast volume of output from nikto are lines like this: > > + OSVDB-651: > /cgi-local/cgiemail-1.6/cgicso?query=: > This CGI is vulnerable to Cross Site Scripting (XSS). > http://www.cert.org/advisories/CA-2000-02.html. > + OSVDB-651: > /cgi-local/cgiemail-1.4/cgicso?query=: > This CGI is vulnerable to Cross Site Scripting (XSS). > http://www.cert.org/advisories/CA-2000-02.html. > + OSVDB-7022: > > /calendar.php?year=&month=03&day=05: > DCP-Portal v5.3.1 is vulnerable to Cross Site Scripting (XSS). > http://www.cert.org/advisories/CA-2000-02.html. > > It could be that my theory on why this is happening is just plain wrong. > > -G > > > > That should work. what is the response code you're sending for 404s, is > it > > 200 or something else? > > > > Also, you can put them in udb_404_strings so an update won't step on your > > own changes. > > > > -Sullo > > > > On Mon, Nov 19, 2012 at 12:06 PM, Geoff Galitz wrote: > > > >> > >> > >> Hi all. > >> > >> I am getting what seem to be false positives. I suspect nikto is not > >> recognizing the custom 404s we send out. I've added some of the text > >> and > >> some of the unique code of our 404 to db_404_strings but it does not > >> seem > >> to help. > >> > >> I am wondering if I need to do anything special after simply adding some > >> text to that file? Currently I have this:

>> style="bottom: 98px;"> > >> > >> Would special punctuation cause a problem? > >> > >> -G > >> > >> > >> > >> ------------------------------ > >> Geoff Galitz > >> http://www.galitz.org > >> > >> _______________________________________________ > >> Nikto-discuss mailing list > >> Nikto-discuss at attrition.org > >> https://attrition.org/mailman/listinfo/nikto-discuss > >> > > > > > > > > -- > > > > http://www.cirt.net | http://richsec.com/ > > > > > ------------------------------ > Geoff Galitz > http://www.galitz.org > > -- http://www.cirt.net | http://richsec.com/ -------------- next part -------------- An HTML attachment was scrubbed... URL: From geoff at galitz.org Mon Nov 19 12:05:32 2012 From: geoff at galitz.org (Geoff Galitz) Date: Mon, 19 Nov 2012 10:05:32 -0800 Subject: [Nikto-discuss] db_404_strings processing In-Reply-To: References: <8976dd6205eb1dccc8e7eff42150eb27.squirrel@webmail.sonic.net>

Message-ID: <5676d30a9b4f98e5b7623cb25364a104.squirrel@webmail.sonic.net> Ah ha... indeed the string is being echoed in the 404 doc. What's the best way to deal with that? -G > is the attack string echoed in the 404 page anywhere? those should match > on > the content with a regex, and only trigger if that raw string is found. > > On Mon, Nov 19, 2012 at 12:51 PM, Geoff Galitz wrote: > >> >> If I use curl -v to inspect it, it shows as a 404, though we return a >> pretty big page with that. >> >> It seems like all of these false positives are XSS related. When I >> issue >> that URL manually (in a web browser or via curl) I get the expected >> custom >> 404 page. >> >> Among the vast volume of output from nikto are lines like this: >> >> + OSVDB-651: >> /cgi-local/cgiemail-1.6/cgicso?query=: >> This CGI is vulnerable to Cross Site Scripting (XSS). >> http://www.cert.org/advisories/CA-2000-02.html. >> + OSVDB-651: >> /cgi-local/cgiemail-1.4/cgicso?query=: >> This CGI is vulnerable to Cross Site Scripting (XSS). >> http://www.cert.org/advisories/CA-2000-02.html. >> + OSVDB-7022: >> >> /calendar.php?year=&month=03&day=05: >> DCP-Portal v5.3.1 is vulnerable to Cross Site Scripting (XSS). >> http://www.cert.org/advisories/CA-2000-02.html. >> >> It could be that my theory on why this is happening is just plain wrong. >> >> -G >> >> >> > That should work. what is the response code you're sending for 404s, >> is >> it >> > 200 or something else? >> > >> > Also, you can put them in udb_404_strings so an update won't step on >> your >> > own changes. >> > >> > -Sullo >> > >> > On Mon, Nov 19, 2012 at 12:06 PM, Geoff Galitz >> wrote: >> > >> >> >> >> >> >> Hi all. >> >> >> >> I am getting what seem to be false positives. I suspect nikto is not >> >> recognizing the custom 404s we send out. I've added some of the text >> >> and >> >> some of the unique code of our 404 to db_404_strings but it does not >> >> seem >> >> to help. >> >> >> >> I am wondering if I need to do anything special after simply adding >> some >> >> text to that file? Currently I have this:

> id="not-found-content" >> >> style="bottom: 98px;"> >> >> >> >> Would special punctuation cause a problem? >> >> >> >> -G >> >> >> >> >> >> >> >> ------------------------------ >> >> Geoff Galitz >> >> http://www.galitz.org >> >> >> >> _______________________________________________ >> >> Nikto-discuss mailing list >> >> Nikto-discuss at attrition.org >> >> https://attrition.org/mailman/listinfo/nikto-discuss >> >> >> > >> > >> > >> > -- >> > >> > http://www.cirt.net | http://richsec.com/ >> > >> >> >> ------------------------------ >> Geoff Galitz >> http://www.galitz.org >> >> > > > -- > > http://www.cirt.net | http://richsec.com/ > ------------------------------ Geoff Galitz http://www.galitz.org From csullo at gmail.com Mon Nov 19 12:06:54 2012 From: csullo at gmail.com (Sullo) Date: Mon, 19 Nov 2012 13:06:54 -0500 Subject: [Nikto-discuss] db_404_strings processing In-Reply-To: <5676d30a9b4f98e5b7623cb25364a104.squirrel@webmail.sonic.net> References: <8976dd6205eb1dccc8e7eff42150eb27.squirrel@webmail.sonic.net>

<5676d30a9b4f98e5b7623cb25364a104.squirrel@webmail.sonic.net> Message-ID: Is it actually vulnerable or escaped or ... ? The solution depends on the actual way this is done, safely or not! On Mon, Nov 19, 2012 at 1:05 PM, Geoff Galitz wrote: > > > Ah ha... indeed the string is being echoed in the 404 doc. What's the > best way to deal with that? > > -G > > > > > is the attack string echoed in the 404 page anywhere? those should match > > on > > the content with a regex, and only trigger if that raw string is found. > > > > On Mon, Nov 19, 2012 at 12:51 PM, Geoff Galitz wrote: > > > >> > >> If I use curl -v to inspect it, it shows as a 404, though we return a > >> pretty big page with that. > >> > >> It seems like all of these false positives are XSS related. When I > >> issue > >> that URL manually (in a web browser or via curl) I get the expected > >> custom > >> 404 page. > >> > >> Among the vast volume of output from nikto are lines like this: > >> > >> + OSVDB-651: > >> > /cgi-local/cgiemail-1.6/cgicso?query=: > >> This CGI is vulnerable to Cross Site Scripting (XSS). > >> http://www.cert.org/advisories/CA-2000-02.html. > >> + OSVDB-651: > >> > /cgi-local/cgiemail-1.4/cgicso?query=: > >> This CGI is vulnerable to Cross Site Scripting (XSS). > >> http://www.cert.org/advisories/CA-2000-02.html. > >> + OSVDB-7022: > >> > >> > /calendar.php?year=&month=03&day=05: > >> DCP-Portal v5.3.1 is vulnerable to Cross Site Scripting (XSS). > >> http://www.cert.org/advisories/CA-2000-02.html. > >> > >> It could be that my theory on why this is happening is just plain wrong. > >> > >> -G > >> > >> > >> > That should work. what is the response code you're sending for 404s, > >> is > >> it > >> > 200 or something else? > >> > > >> > Also, you can put them in udb_404_strings so an update won't step on > >> your > >> > own changes. > >> > > >> > -Sullo > >> > > >> > On Mon, Nov 19, 2012 at 12:06 PM, Geoff Galitz > >> wrote: > >> > > >> >> > >> >> > >> >> Hi all. > >> >> > >> >> I am getting what seem to be false positives. I suspect nikto is not > >> >> recognizing the custom 404s we send out. I've added some of the text > >> >> and > >> >> some of the unique code of our 404 to db_404_strings but it does not > >> >> seem > >> >> to help. > >> >> > >> >> I am wondering if I need to do anything special after simply adding > >> some > >> >> text to that file? Currently I have this:

>> id="not-found-content" > >> >> style="bottom: 98px;"> > >> >> > >> >> Would special punctuation cause a problem? > >> >> > >> >> -G > >> >> > >> >> > >> >> > >> >> ------------------------------ > >> >> Geoff Galitz > >> >> http://www.galitz.org > >> >> > >> >> _______________________________________________ > >> >> Nikto-discuss mailing list > >> >> Nikto-discuss at attrition.org > >> >> https://attrition.org/mailman/listinfo/nikto-discuss > >> >> > >> > > >> > > >> > > >> > -- > >> > > >> > http://www.cirt.net | http://richsec.com/ > >> > > >> > >> > >> ------------------------------ > >> Geoff Galitz > >> http://www.galitz.org > >> > >> > > > > > > -- > > > > http://www.cirt.net | http://richsec.com/ > > > > > ------------------------------ > Geoff Galitz > http://www.galitz.org > > -- http://www.cirt.net | http://richsec.com/ -------------- next part -------------- An HTML attachment was scrubbed... URL: From geoff at galitz.org Mon Nov 19 12:33:37 2012 From: geoff at galitz.org (Geoff Galitz) Date: Mon, 19 Nov 2012 10:33:37 -0800 Subject: [Nikto-discuss] db_404_strings processing In-Reply-To: References: <8976dd6205eb1dccc8e7eff42150eb27.squirrel@webmail.sonic.net>

<5676d30a9b4f98e5b7623cb25364a104.squirrel@webmail.sonic.net> Message-ID: <2a9790b0f80793fe57575e0a03fcfebf.squirrel@webmail.sonic.net> It does not appear vulnerable. The string is being echoed it seems for translation. For example this is the string that matches: Is it actually vulnerable or escaped or ... ? The solution depends on the > actual way this is done, safely or not! > > On Mon, Nov 19, 2012 at 1:05 PM, Geoff Galitz wrote: > >> >> >> Ah ha... indeed the string is being echoed in the 404 doc. What's the >> best way to deal with that? >> >> -G >> >> >> >> > is the attack string echoed in the 404 page anywhere? those should >> match >> > on >> > the content with a regex, and only trigger if that raw string is >> found. >> > >> > On Mon, Nov 19, 2012 at 12:51 PM, Geoff Galitz >> wrote: >> > >> >> >> >> If I use curl -v to inspect it, it shows as a 404, though we return a >> >> pretty big page with that. >> >> >> >> It seems like all of these false positives are XSS related. When I >> >> issue >> >> that URL manually (in a web browser or via curl) I get the expected >> >> custom >> >> 404 page. >> >> >> >> Among the vast volume of output from nikto are lines like this: >> >> >> >> + OSVDB-651: >> >> >> /cgi-local/cgiemail-1.6/cgicso?query=: >> >> This CGI is vulnerable to Cross Site Scripting (XSS). >> >> http://www.cert.org/advisories/CA-2000-02.html. >> >> + OSVDB-651: >> >> >> /cgi-local/cgiemail-1.4/cgicso?query=: >> >> This CGI is vulnerable to Cross Site Scripting (XSS). >> >> http://www.cert.org/advisories/CA-2000-02.html. >> >> + OSVDB-7022: >> >> >> >> >> /calendar.php?year=&month=03&day=05: >> >> DCP-Portal v5.3.1 is vulnerable to Cross Site Scripting (XSS). >> >> http://www.cert.org/advisories/CA-2000-02.html. >> >> >> >> It could be that my theory on why this is happening is just plain >> wrong. >> >> >> >> -G >> >> >> >> >> >> > That should work. what is the response code you're sending for >> 404s, >> >> is >> >> it >> >> > 200 or something else? >> >> > >> >> > Also, you can put them in udb_404_strings so an update won't step >> on >> >> your >> >> > own changes. >> >> > >> >> > -Sullo >> >> > >> >> > On Mon, Nov 19, 2012 at 12:06 PM, Geoff Galitz >> >> wrote: >> >> > >> >> >> >> >> >> >> >> >> Hi all. >> >> >> >> >> >> I am getting what seem to be false positives. I suspect nikto is >> not >> >> >> recognizing the custom 404s we send out. I've added some of the >> text >> >> >> and >> >> >> some of the unique code of our 404 to db_404_strings but it does >> not >> >> >> seem >> >> >> to help. >> >> >> >> >> >> I am wondering if I need to do anything special after simply >> adding >> >> some >> >> >> text to that file? Currently I have this: